00. Profiling the Liberty Front Press Network Online - An OSINT Analysis 


We've decided to take a closer look at the Internet-connected infrastructure of the Liberty Front 
Press Network part of a recent takedown and domain seizure part of an ongoing law 
enforcement operation fighting online propaganda online and to offer practical and relevant 
including actionable intelligence on the Internet-connected infrastructure behind the Liberty 
Front Press Network including the individuals behind it. 


In this analysi we'll take a closer look inside the Internet-connected infrastructure behind the 
Liberty Front Press Network and offer practical and relevant information including actionable 
intelligence on its Internet-connected infrastructure including the individuals behind it. 
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Sample screenshot of various related domain name registrations using WhoisXML API’s and 
Maltego’s Integration 


Related domains known to have been currently registered using the same registrant 
email addresses part of the Liberty Front Press Network Internet-connected 
infrastructure: 


syriact-sy[.]Jcom 
darfikr[.Jnet 
aminbaik[.Jcom 
aminelzeintrading[.]com 
khamenaeil[.]com 
shaghaaf[.Jcom 
app-line[.Jir 
alzouzougroup[.]com 
trustmiddleeast[.]Jcom 
raha-travel[.]Jcom 
mg-sy[.]Jcom 
sinasibsalamat[.]com 
ansar-allah[.]Jcom 
aletthadnews-iq[.]org 
asiaquran[.]com 


payamkherad[.]Jcom 
alavitile[.Jcom 


mohseny[.]org 


farhang-press[.]Jcom 


moshaver-sanati[. Jir 


nsafari[.Jir 


bpaorg[.]Jcom 


payamekherad[.]Jcom 


goshayesh[.Jorg 
walifaqih[.]com 


islamwilayah[.Jcom 


walifaqih[.]info 


Related malicious and fraudulent domains known to have been historically registered 
using the same email addresses: 


nilenetonline[.Jorg 
ansaroallah[.]Jorg 
hajez-sy[.Jinfo 
syriaalhadath[.Jorg 
alwaienews[.]net 
syriaalhadath[.]Jcom 
alwaght[.]net 
alwaienews[.]com 
ansaroallah[.]net 
ansaroallah[.]info 
farhang-press[.]Jcom 
navidplastL. Jir 
iauaf_.Jir 

nsafari[.Jir 
sokhanetarikh[.]Jcom 
af[.Jgl 
mohajeronline[. ir 
yosin[.Jorg 
mohajeronline[.]Jorg 
afghanistanemaf. ir 
iranindia[.Jorg 
imenhostL[.]Jorg 
iuvmdaily[.]net 
iuvmdaily[.]Jcom 
arab-now[.]com 
aleppospace[.]com 
harbi-media[.]com 
ehsan-sy[.Jorg 
truemedia-sy[.]Jcom 
syria-victory[.]com 
scope-photos[.]com 
u-rogqayya[.]Jcom 
aminbaik[.]Jcom 
furatorder[.Jcom 
alzouzougroup[.]com 
darfikr[.]net 
trustmiddleeast[.]net 
eset-sy[.]Jcom 
darfikr[.Jcom 
syriact-sy[.]Jcom 
souqsyria[.Jcom 


alameensupport[.Jcom 
ait-sy[.]Jcom 
shaghaaf[.Jcom 
app-line[.Jir 
afghanfeed[.Jcom 
atlaspress[.Jorg 
roushd[.]com 
haghline[.]Jcom 
faryadmag[.]Jcom 
barchinews[.]com 
pashtunews[.]Jcom 
reachpage[.]ir 
darinews[.]Jcom 
raha-travel[.]Jcom 
sinasibsalamat[.]com 
walifaqih[.]com 
titisan[.]net 
hpiiran[.Jcom 
titisan[.Jorg 
walifagih[.Jorg 
islamwilayah[.Jcom 
mediaadil[.]Jcom 
syiahahlilbait[.Jcom 
saintshepherd[.]Jcom 
walifaqih[.]info 
newsaktuall.]Jcom 
hajez-sy[.]Jcom 
ansar-allah[.]Jcom 
online-traveler[.Jcom 


Sample responding IPs for some of the domains known to have been historically 
registered using the same email addresses: 


5[.]220[.132[.126 
104[.131[.]90[.]232 
172[.]67[.]218[.]252 
185[.]202[.]92[.]26 
104[.]21[.]16[.]144 
104[.]28[.]15[.]223 
104[.131[.191[.]232 
104[.]27[.1191[.]22 
172[.]245].]14[.]202 
172[.]67[.]155I.]39 
104[.]27[.]190[.]22 


104[.J21[.]11[.189 
104[.]28[.]14].]223 
199[.]59[.1242[.]150 
188[.]0[.]245].]26 
172[.]67[.]165[.]178 
104[.]18[.]63[.]141 
104[.]27[.]174[.]61 
104[.]27[.]175[.]61 
104].131[.]95[.]165 
104].131[.]94[.]165 
95[.]217[.]63[.]156 
185[.]88[.]178[.]104 
94[.]130[.]129[.]47 
95[.]216[.]246[.]232 
AG[.]166[.]182[.]56 
108[.]59[.]12[.]100 
198[.]71[.]232[.]3 
108[.]61[.]19].]12 
18[.]197[.1248[.]23 
499[.]115[.]115].]102 
172[.]93[.]194[.]60 
192[.]155[.]108[.]158 
199[.]115[.]115[.]119 
108[.]59[.]12].]98 
AG[.]166[.]182[.]55 
52[.]59[.]120[.]70 
108[.]59[.]12[.]101 
217[.]182[.]208[.]108 
5[.]79[.]68[.]109 
162[.]210[.]195].]123 
AG[.]166[.]182[.]52 
63[.]143[.]32[.]94 
172[.]93[.]194[.]61 
184[.]168.]221[.]34 
108[.]61[.]19[.]13 
52[.]11[.]10[.]90 
52[.J40[.]118].]225 
AAI .]229].]2231.]74 
34[.]211[.]213[.]227 
167[.]99[.]26[.]105 
185[.]26[.]105[.]244 
34[.]208[.]93[.]148 
52[.143[.121[.]0 
52[.18[.]174[.168 


50[.]112[.]29[.]189 
34[.1214].]135[.141 
50[.]112].146[.14 
34[.]211[.]118[.]203 
209[.]251[.]26[.]166 
172[.]67[.]145[.]166 
79[.1143[.]85[.144 
104[.]21[.]73].]146 
88[.]198[.]13[.]86 
AG[.J4[.]6[.1184 
104[.]18[.]40[.]203 
104[.]18[.141[.]203 
172[.]67[.]131[.]105 
104[.]21[.141.]3 
138[.]201[.]142[.]150 
78[.]47[.]230[.]139 
104[.]27[.]154[.]187 
172[.]67[.]176[.]84 
104[.]27[.]155[.]187 
198[.]38[.]82[.]90 
127[.JO[.JO[.]1 
216[.]104[.]165].]72 
209[.]251[.]26[.]169 
172[.]67[.]133[.]177 
104[.]21[.]5[.]179 
173[.]45[.]114[.]24 
104[.]28[.]12[.]91 
209.]251[.]26[.]164 
104[.]28[.]13[.]91 
104[.131[.]77[.]253 
A7[.]91[.]170[.]222 
185[.]53[.]177[.]20 
104[.131[.]76[.]253 
176[.]9[.]79[.191 
88[.]198[.]56[.]139 
104[.]18[.47[.]243 
104[.]18[.146[.]243 
185[.]87[.]187[.]198 
52[.]213[.]114[.186 
104[.]28[.]25[.]112 
212[.]83[.]172[.]150 
104[.]21[.]6[.]168 
172[.]67[.]135[.]11 
176[.]9[.]29[.]165 


104[.]28[.]24[.]112 
144[.]91[.]104[.]181 
34[.]102[.]136[.]180 
62[.]171[.]177[.]42 
192[.]64[.]10[.]106 
216[.]104[.]165].]3 
216[.]104[.]165].]2 
208[.]67[.]23[.]136 
208[.]67[.]23.]101 
34[.]224[.]160[.]149 
216[.]104[.]165.]90 
72[.11[.132[.]168 
162[.]210[.]196[.]167 
37[.]48[.]65[.]152 
37[.]48[.]65[.]154 
37[.]48[.]65[.]155 
216[.]104[.]165].]30 
109[.]201[.]135].]45 
104[.]18[.]34[.]105 
5[.]79[.]68[.]107 
162[.]210[.]196[.]168 
499[.]115].]116[.]216 
172[.]98[.]192[.]37 
104[.]21[.]88[.]42 
37[.]48[.]65[.]153 
172[.]67[.]172[.]76 
104[.]18[.]35[.]105 
172[.]67[.]208[.]182 
104[.]24[.]118[.]67 
208[.]91[.]197[.]46 
104[.131[.183[.]28 
172[.]67[.]152[.]252 
104[.131[.182[.]28 
104[.]21[.]49].]222 
104[.]24[.]109[.]208 
104[.]24[.]108[.]208 
499[.]115[.]116[.]162 
162[.]210[.]196[.]173 
94[.]229[.172[.1117 
104[.121[.151[.1133 
94[.]229].]72[.1115 
95[.]211[.]187[.]100 
162[.]210[.]196[.]171 
188[.]165.]44[.]218 


94[.]229[.]72[.1116 
104[.]24[.]119].]67 
94[.]229].]72[.1120 
216[.]104[.]165[.]12 
162[.]210.]196[.]172 
104[.]28[.]30[.]73 
94[.]229[.172[.1118 
172[.]67[.]180[.]160 
94[.]229].]72[.1124 
104[.]24[.J97[.]171 
94[.]229[.]72[.1123 
104[.]24[.]96[.]171 
144[.]76[.]32[.]148 
104[.]28[.131[.]73 
148[.]251[.1[.171 
109[.]201[.]135[.]71 
185[.]208[.]173[.]3 
109[.]201[.]135[.]39 
54[.]38[.]220[.]85 
96[.]47[.]230[.]67 
151[.]106[.]5[.]168 
108[.161[.]19[.111 
192[.]155[.]108[.]153 
162[.]210[.]196[.]166 
109[.]201[.]135[.]46 
151[.]106[.]5[.]173 
192[.]155[.]108[.]156 
151[.]106[.]5[.]165 
192[.]155[.]108[.]150 
151[.]106[.]5[.]164 
104[.]21[.132[.]133 
172[.]67[.]152[.]55 
172[.]67[.]187[.]82 
104[.]21[.]72[.]204 
104[.]27[.]149[.]153 
104[.]27[.]148[.]153 
207[.]244I.]67[.]218 
208[.]67[.]16[.]254 
151[.]106[.]5[.]169 
192[.]155[.]108[.]152 
37[.]48[.165[.]149 
151[.]106[.]5[.]170 
151[.]106[.]5[.]167 
192[.]155[.]108[.]151 


151[.]106[.]5[.]163 
37[.]48[.]65[.]150 
192[.]155[.]108[.]149 
192[.]155[.]108[.]154 
37[.]48[.]65[.]151 
192[.]155[.]108[.]147 
151[.]106[.]5[.]166 
151[.]106[.]5[.]174 
209J.]99J.140[.]222 
156[.]67[.]211[.]180 
213[.]247[.147[.1190 
104[.131[.182[.]19 
104[.131[.]83[.]19 
104[.]247[.181[.]10 
34[.]98[.]99[.130 
173[.]239[.]8[.]164 
173[.]239].]5[.16 
AG[.]166[.]184[.]102 
104[.]247].182[.]10 
91[.]195[.]240[.]117 
176[.]9[.185[.]197 
185[.]53[.]179[.]7 
185[.]206[.]180[.]123 
185[.]53[.]178[.]10 
192[.]99[.]147[.]163 
107[.]150[.]52[.]242 
104[.]21[.]40[.]J221 
104[.]18[.149[.]253 
174[.]120[.]70[.]159 
172[.]67[.]157[.138 
151[.]106[.]5[.]172 
208[.167[.]23I.131 
104[.]18[.]48[.]253 
192[.]155[.]108[.]157 
104[.]21[.]6[.]160 
66[.]152[.]163[.]75 
104[.]28[.]9[.1112 
172[.]67[.]135].]3 
209J.]99J.140[.]220 
192[.]155[.]108[.]155 
49[.]128[.]177[.181 
156[.]67[.]211[.]189 
207[.]244[.]67[.]138 
109[.]201[.]135].]65 


37[.]48[.165[.]148 
104[.]28[.]8[.]112 
5[.]79[.]68[.]110 
104[.]28[.]21[.]230 
104[.]27[.]177[.]28 
172[.]67[.]154[.]209 
172[.]67[.]218[.]104 
208[.]67[.]23I.136 
104[.]27[.]176[.]28 
104[.]21[.]6[.]86 
104[.131[.]66[.]144 
104[.]21[.]10[.]32 
104[.]28[.]20[.]230 
172[.]67[.]189[.]225 
51[.]89].]88[.]96 
104[.]31[.]671.1144 
69[.]172[.]201[.]153 
69[.]172[.]201[.]208 
AG[.]166[.]184[.]104 
52[.]128[.]23[.]153 
78[.]46[.]102[.]123 
176[.]9[.143[.140 
173[.]208[.]153[.]250 
174[.]128].]248].]231 
149[.]56[.]147[.]39 
88[.]198[.]48[.]179 
144[.]76[.]140[.]66 
150[.]95[.]255[.]38 
184[.]168[.]221[.]43 
104].J28[.]15/.J51 
104[.]28[.]14[.151 
202J.]150[.J213[.]60 
156[.]67[.]209[.]15 
85[.]159].]233[.]35 
192[.]155[.]108[.]148 
104[.]27[.]130[.]254 
104[.131[.194[.14 
154[.]92[.J251[.]72 
104[.]27[.]131[.]254 
104[.]21[.]75[.]92 
104[.]27[.]146[.]35 
104[.]21[.]39[.]77 
104[.]27[.]147[.135 
85[.]159].]233].]60 


104[.]237[.]196[.]117 
207[.]244I.]67[.1214 
104[.]24[.]118[.]189 
104[.]24[.]119].]189 
104[.]18[.]40[.]90 
5[.J9[.J96[.]104 
136[.]243I.]19I.]6 
95[.]216[.]77[.]5 
192[.]99[.]92[.]2 
172[.]67[.]217[.]163 
176[.]31[.]51[.]154 
51[.]254[.]232[.]56 
104[.]18[.]41[.]90 
54[.137[.12181.]50 
172[.]67[.]143[.]200 
209J.]251[.]26[.]162 
104[.]27[.]154[.]78 
172[.]67[.]206[.]116 
184[.]168[.]221[.]59 
104[.]27[.]155[.]78 
104[.]21[.]77[.]94 


We'll continue monitoring the campaign and post updates as soon as new developments take 
place. 


